Cookie notice
Four cookies, all strictly necessary, and nothing else — so there is no banner to dismiss.
Last updated
1.The short version
OtterSR sets four cookies. All of them are strictly necessary: one signs you in, one protects that session from cross-site request forgery, one carries the state of a sign-in round trip, and one remembers which language you chose. There are no analytics cookies and no advertising cookies, because there is no analytics and no advertising.
That is why you are not being asked to consent to anything. Consent is required for cookies that are not strictly necessary, and we do not set any.
2.Every cookie we set
| Name | Purpose | Lifetime | Flags |
|---|---|---|---|
| ottersr_session | Your sign-in. It holds an opaque identifier for a session record on our server — no token, no personal data, nothing readable. | Up to 30 days; the session also expires after 14 days of inactivity. Cleared on sign-out. | httpOnly, SameSite=Lax, Secure in production |
| ottersr_csrf | Cross-site request forgery protection. The application reads it and echoes it back in a header on every state-changing request, which a third-party site cannot do. | Same as the session. | Readable by the page (that is the point), SameSite=Lax, Secure in production |
| ottersr_oauth | Carries the state and nonce of a sign-in round trip to Google or Microsoft, so the response can be matched to the request that started it. | 10 minutes. | httpOnly, SameSite=Lax, Secure in production |
| NEXT_LOCALE | Remembers whether you chose English or French, so you are not sent back to the default on your next visit. | Up to a year. | Not httpOnly; contains only "en" or "fr" |
3.Local storage
Two things are kept in your browser rather than in a cookie, which means they are never sent to our server:
ottersr.theme— whether you chose the light theme, the dark theme or your system setting.- Small workspace preferences inside the application, such as pane widths and text size.
There is no credential in local storage. No token, no session identifier, nothing that could sign someone in. That is deliberate and is checked by an automated test.
4.Third-party cookies
None on the marketing site or in the application. We do not embed analytics, ads, social widgets, support chat, session recording or third-party fonts.
Two exceptions you will meet by leaving our pages: when you sign in, Google or Microsoft sets its own cookies on its own domain under its own policy; and when you enter card details, Stripe’s payment element does the same. Neither can read our cookies and we cannot read theirs.
5.Refusing them
Your browser can block or delete cookies for this site. Blocking ottersr_session or ottersr_csrf means you cannot sign in — they are how signing in works — but the marketing site, including this page and everything under /legal, reads perfectly well with every cookie blocked.
6.Changes
If we ever add a cookie that is not strictly necessary, this page will say so before it is set, and you will be asked to consent first. Questions: support@ottersr.com.